deepline 0.3.460 → 0.3.462

package/dist/bundling-sources/shared_libs/play-runtime/context.ts

@@ -54,6 +54,7 @@ import type { CompiledRequestBatch } from './batch-runtime';
 import type { AnyBatchOperationStrategy } from './batching-types';
 import {
   getBillingEntitlementsViaAppRuntime,
+  writePageViaAppRuntime,
   type RuntimeApiResponseMeta,
 } from './app-runtime-api';
 import {
@@ -109,6 +110,8 @@ import {
 import { isImmutableRuntimeExecutionRecoveryOrigin } from './scheduler-backends/runtime-api-origin';
 import {
   isRetryableSecretResolutionStatus,
+  secretResolutionGotNoResponse,
+  secretResolutionOutageRetryDelayMs,
   secretResolutionRetryDecision,
   SECRET_RESOLUTION_MAX_ATTEMPTS,
   SECRET_RESOLUTION_ATTEMPT_TIMEOUT_MS,
@@ -136,6 +139,7 @@ import {
   type PacingResolver,
   type PlayExecutionGovernor,
 } from './governor/governor';
+import { hasExplicitRowConcurrency } from './governor/policy';
 import {
   createRuntimeResourceGovernor,
   type RuntimeResourceGovernor,
@@ -214,6 +218,7 @@ import {
   createAlwaysFreshToolCallAdapter,
   createExternallyOwnedToolResultReceipts,
   createNativeBatchToolCallJob,
+  createMappedToolCallJob,
   createToolCallReceiptCohortJob,
   createRuntimeStepToolResultReceipts,
   createToolCallJob,
@@ -232,6 +237,7 @@ import {
   type ToolExecutionOutcome,
 } from './tool-execution-outcome';
 import {
+  toolExecuteConnectRetryDelayMs,
   TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS,
   TOOL_EXECUTE_RUNNER_ACCEPTS_HEADER,
   TOOL_EXECUTE_RUNNER_ACCEPTS_VALUE,
@@ -260,6 +266,7 @@ import {
 } from './tool-http-errors';
 import {
   describeTransportError,
+  transportFailureProvesRequestNeverSent,
   transportGatewayOriginForDiagnostic,
 } from './transport-error-diagnostics';
 import {
@@ -292,6 +299,8 @@ import {
   type PlaySecretPromise,
   type PlaySqlQuery,
   type PlayAuthoringRunScope,
+  type PlayAuthoringPageWriteOptions,
+  type PlayAuthoringPageWriteResult,
   type PlayAuthoringRuntimeContext,
   type PlayAuthoringRunStepsOptions,
 } from '../plays/authoring-contract';
@@ -402,6 +411,14 @@ import {
   type RuntimeMapHeapAdmissionSnapshot,
 } from './map-memory-limits';
 import { RuntimeMapRowFeed } from './runtime-map-row-feed';
+import {
+  iterateSealedRuntimeArrayInput,
+  sealRuntimeArrayInput,
+  RuntimeArrayInputStoreUnavailableError,
+  isLosslessArrayInputValue,
+  type RuntimeArrayInputManifest,
+  type RuntimeArrayInputScope,
+} from './array-input-store';
 import { ProviderRowRetryQueue } from './provider-row-retry-queue';
 import type { ProviderRowRetry } from './provider-row-retry-queue';
 import type { RuntimeMapRowFeedSnapshot } from './runtime-map-row-feed';
@@ -655,6 +672,7 @@ const authoredStepContext = new AsyncLocalStorage<{
 }>();
 const toolExecutionOverrides = new AsyncLocalStorage<{ force: boolean }>();
 const PROGRESS_HEARTBEAT_INTERVAL_MS = 1_000;
+
 const PURE_JS_HEARTBEAT_ROW_INTERVAL = 250;
 /** Executed-row sheet persistence chunking: rows AND bytes, whichever first. */
 const MAP_PERSIST_CHUNK_ROWS = 2_000;
@@ -1462,9 +1480,23 @@ function isUnmarkedExecutionGateway502(input: {
   }
 }
 
-function waitForSecretResolutionRetry(ms: number): Promise<void> {
+function waitForSecretResolutionRetry(
+  ms: number,
+  signal?: AbortSignal,
+): Promise<void> {
+  signal?.throwIfAborted();
   if (ms <= 0) return Promise.resolve();
-  return new Promise<void>((resolve) => setTimeout(resolve, ms));
+  return new Promise<void>((resolve, reject) => {
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal?.reason);
+    };
+    const timer = setTimeout(() => {
+      signal?.removeEventListener('abort', onAbort);
+      resolve();
+    }, ms);
+    signal?.addEventListener('abort', onAbort, { once: true });
+  });
 }
 
 function cancelRuntimeResponseBody(response: Response): void {
@@ -2720,6 +2752,7 @@ type ScalarPlayAuthoringRuntimeContext = Pick<
   | 'tools'
   | 'customerDb'
   | 'billing'
+  | 'pages'
   | 'run'
   | 'tool'
   | 'step'
@@ -2730,6 +2763,36 @@ type ScalarPlayAuthoringRuntimeContext = Pick<
   | 'sleep'
 >;
 
+/** Text stays text on the wire, so only real binary pays the base64 overhead. */
+function encodePageContent(
+  name: string,
+  options: PlayAuthoringPageWriteOptions,
+): { contentType: string } & (
+  | { contentText: string }
+  | { contentBase64: string }
+) {
+  const { content, contentType } = options;
+  if (typeof content === 'string') {
+    return {
+      contentType: contentType ?? 'text/plain; charset=utf-8',
+      contentText: content,
+    };
+  }
+  if (content instanceof Uint8Array || content instanceof ArrayBuffer) {
+    return {
+      contentType: contentType ?? 'application/octet-stream',
+      contentBase64: Buffer.from(content as Uint8Array).toString('base64'),
+    };
+  }
+  const contentText = JSON.stringify(content);
+  if (contentText === undefined) {
+    throw new Error(
+      `ctx.pages.write("${name}") requires content: a string, bytes, or a JSON value.`,
+    );
+  }
+  return { contentType: contentType ?? 'application/json', contentText };
+}
+
 export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   private rowStates = new Map<number, RowState>();
   private toolCallQueue: ToolCallRequest[] = [];
@@ -3023,6 +3086,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   private readonly providerResponseBodyGate = createRuntimeReceiptHydrationGate(
     {
       occupancy: this.runtimeMemoryOccupancy,
+      reservationCategory: 'providerBody',
+      // Existing egress byte-work boundary, not a memory/output/width limit.
+      cooperativeYieldBytes: RUNTIME_RECEIPT_WRITER_TARGET_BATCH_BYTES,
       reserve: (bytes) =>
         this.memoryLedger.register({ category: 'providerBody', bytes }),
     },
@@ -3355,6 +3421,40 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     },
   };
 
+  readonly pages = {
+    write: async (
+      name: string,
+      options: PlayAuthoringPageWriteOptions,
+    ): Promise<PlayAuthoringPageWriteResult> => {
+      this.assertNoPendingDurableSuspension();
+      if (typeof name !== 'string' || !name) {
+        throw new Error('ctx.pages.write(name, options) requires a page name.');
+      }
+      if (typeof options?.public !== 'boolean') {
+        throw new Error(
+          `ctx.pages.write("${name}") requires public: true or false, so the write always says who can see the page.`,
+        );
+      }
+      const result = await writePageViaAppRuntime(
+        {
+          baseUrl: this.#options.baseUrl ?? '',
+          executorToken: this.#options.executorToken ?? '',
+          vercelProtectionBypassToken:
+            this.#options.vercelProtectionBypassToken,
+          signal: this.#options.executionSignal,
+        },
+        {
+          name,
+          public: options.public,
+          description: options.description,
+          ...encodePageContent(name, options),
+        },
+      );
+      for (const warning of result.warnings) this.log(warning);
+      return result;
+    },
+  };
+
   readonly secrets = {
     get: (name: string): PlaySecretPromise => {
       if (typeof name !== 'string' || !name.trim()) {
@@ -4415,21 +4515,28 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       const url = `${this.#options.baseUrl.replace(/\/$/, '')}${PLAY_RUNTIME_API_COMPAT_PATH}`;
       const operationId = `ctx-secret-operation-${crypto.randomUUID()}`;
       const operationStartedAt = Date.now();
-      for (
-        let attempt = 1;
-        attempt <= SECRET_RESOLUTION_MAX_ATTEMPTS;
-        attempt += 1
-      ) {
+      // Error responses spend the ordinary attempts. A lookup that gets no
+      // response at all keeps retrying through a sandbox network cut, so the
+      // run's cancellation must stop both the request and the wait.
+      const executionSignal = this.#options.executionSignal;
+      let respondedAttempts = 0;
+      for (let attempt = 1; ; attempt += 1) {
+        executionSignal?.throwIfAborted();
         const requestId = `ctx-secret-${crypto.randomUUID()}`;
         const attemptStartedAt = Date.now();
+        // Bound the control-plane call so a stalled connection aborts and is
+        // caught below as a transport failure instead of hanging the tool
+        // call "1 in flight" forever.
+        const attemptTimeout = AbortSignal.timeout(
+          SECRET_RESOLUTION_ATTEMPT_TIMEOUT_MS,
+        );
         let response: Response;
         try {
           response = await fetch(url, {
             method: 'POST',
-            // Bound the control-plane call so a stalled connection aborts and is
-            // caught below as a transport failure instead of hanging the tool
-            // call "1 in flight" forever.
-            signal: AbortSignal.timeout(SECRET_RESOLUTION_ATTEMPT_TIMEOUT_MS),
+            signal: executionSignal
+              ? AbortSignal.any([executionSignal, attemptTimeout])
+              : attemptTimeout,
             headers: {
               Authorization: `Bearer ${this.#options.executorToken}`,
               'Content-Type': 'application/json',
@@ -4445,11 +4552,23 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             }),
           });
         } catch (error) {
+          executionSignal?.throwIfAborted();
           const diagnostic = describeTransportError(error);
-          const retry = secretResolutionRetryDecision({
+          const ladder = secretResolutionRetryDecision({
             attempt,
             retryAfter: null,
           });
+          const outageRetryDelayMs =
+            !ladder.retry && secretResolutionGotNoResponse(error)
+              ? secretResolutionOutageRetryDelayMs({
+                  attempt,
+                  elapsedMs: Date.now() - operationStartedAt,
+                })
+              : null;
+          const retry =
+            outageRetryDelayMs === null
+              ? ladder
+              : { ...ladder, retry: true, retryDelayMs: outageRetryDelayMs };
           this.runtimeLog(
             `[runtime.secret_resolution_failure] ${JSON.stringify({
               stage: 'transport',
@@ -4471,13 +4590,20 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               `Secret ${secret.name} resolution transport failed (request_id=${requestId}): ${diagnostic.message ?? 'unknown transport error'}`,
             );
           }
-          await waitForSecretResolutionRetry(retry.retryDelayMs);
+          await waitForSecretResolutionRetry(
+            retry.retryDelayMs,
+            executionSignal,
+          );
           continue;
         }
 
         const retryAfter = response.headers.get('retry-after');
+        respondedAttempts += 1;
         const retry = isRetryableSecretResolutionStatus(response.status)
-          ? secretResolutionRetryDecision({ attempt, retryAfter })
+          ? secretResolutionRetryDecision({
+              attempt: respondedAttempts,
+              retryAfter,
+            })
           : NO_SECRET_RESOLUTION_RETRY;
         const responseDiagnostic = {
           stage: response.ok ? 'invalid_response' : 'http_response',
@@ -4510,7 +4636,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           );
           cancelRuntimeResponseBody(response);
           if (retry.retry) {
-            await waitForSecretResolutionRetry(retry.retryDelayMs);
+            await waitForSecretResolutionRetry(
+              retry.retryDelayMs,
+              executionSignal,
+            );
             continue;
           }
           throw new Error(
@@ -5422,6 +5551,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
   private async withProviderResponseBodyTurn<T>(
     response: Response,
     read: (turn: RuntimeReceiptHydrationTurn) => Promise<T>,
+    signal?: AbortSignal,
   ): Promise<{ value: T; waitMs: number }> {
     const queuedAtMs = Date.now();
     const expectedBytes = runtimeProviderResponseBodyExpectedBytes({
@@ -5432,9 +5562,30 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         this.#options.executionGatewayBaseUrl?.trim(),
       ),
     });
-    const turn = await this.providerResponseBodyGate.acquire({
-      ...(expectedBytes === null ? {} : { expectedBytes }),
-    });
+    let turn: RuntimeReceiptHydrationTurn;
+    try {
+      turn = await this.providerResponseBodyGate.acquire({
+        ...(expectedBytes === null ? {} : { expectedBytes }),
+        ...(signal === undefined ? {} : { signal }),
+      });
+    } catch (error) {
+      // Headers already arrived: an abandoned waiter still owns this unread
+      // stream. Cancel it without replacing the original admission/abort error.
+      const reportCancelFailure = (cancelError: unknown) => {
+        this.runtimeLog(
+          `[runtime-provider-response] unread_body_cancel_failed error=${cancelError instanceof Error ? cancelError.name : 'UnknownError'}`,
+          { level: 'error' },
+        );
+      };
+      try {
+        // Stream cleanup may remain pending (for example, a tee's other branch).
+        // Start it, but do not hold the caller's abort or provider permit on it.
+        void response.body?.cancel(error).catch(reportCancelFailure);
+      } catch (cancelError) {
+        reportCancelFailure(cancelError);
+      }
+      throw error;
+    }
     const waitMs = Math.max(0, Date.now() - queuedAtMs);
     try {
       return { value: await read(turn), waitMs };
@@ -7475,7 +7626,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         return current;
       }
       if (isSerializedToolExecuteResult(current)) {
-        return deserializeToolExecuteResult(current);
+        // Cells store the canonical dataset-valued result; a later column must
+        // see the same edition getters as the column that executed the tool.
+        return projectToolResultListGetters(
+          deserializeToolExecuteResult(current),
+          this.currentRuntimeContract.semantics.tools.listGetters,
+        );
       }
       if (isSerializedPlayDatasetCell(current)) {
         return deserializePlayDatasetCell(current, visit);
@@ -8494,85 +8650,94 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       : Array.isArray(items)
         ? items
         : null;
-    const csvSource =
+    const replayMapInvocationId = `${normalizedMapNamespace}:${this.mapInvocationIndex}`;
+    const replayMapFrame = this.checkpoint.mapFrames?.[replayMapInvocationId];
+    const authoredCsvSource =
       (isPlayDataset(items) && items.datasetKind === 'csv') ||
       residentSourceRows?.some(
         (_row, index) =>
           getPlayDatasetSourceRowIdentityAt(residentSourceRows, index) !==
           undefined,
       ) === true;
-    const csvOccurrenceIdentityRequired =
-      csvSource &&
-      this.currentRuntimeSemantics.datasets.csvRowIdentity === 'source_row';
-    const rowIdentityMode = csvOccurrenceIdentityRequired
-      ? 'source_row'
-      : (options?.rowIdentity ??
-        (options?.key !== undefined
-          ? 'key'
-          : csvSource
-            ? this.currentRuntimeSemantics.datasets.csvRowIdentity
-            : 'key'));
-    const useSourceRowIdentity = rowIdentityMode === 'source_row';
     const userKeyOption = options?.key;
-    let explicitKeyResolver:
-      | ((row: Record<string, unknown>, index: number) => string)
-      | null = null;
-    if (useSourceRowIdentity) {
-      explicitKeyResolver = (row, index) => {
-        const source = getPlayDatasetSourceRowIdentity(row);
-        const inputRow = Object.fromEntries(
-          Object.entries(toSerializableCsvAliasedRow(row)).filter(
-            ([field]) => !field.startsWith('__deepline'),
-          ),
-        );
-        // Position distinguishes equal records; the input digest prevents a
-        // changed file at the same path from replaying an earlier row's output.
-        return JSON.stringify([
-          'source-row-v1',
-          source?.datasetId ??
-            (isPlayDataset(items) ? items.datasetId : normalizedMapNamespace),
-          source?.rowIndex ?? index,
-          stableDigest(stableStringify(inputRow)),
-        ]);
-      };
-    } else if (userKeyOption !== undefined) {
-      explicitKeyResolver = (row, index) => {
-        const inputRow = stripFieldOutputs(row);
-        const raw =
-          typeof userKeyOption === 'function'
-            ? (
-                userKeyOption as (
-                  row: Record<string, unknown>,
-                  index: number,
-                ) => string | number | readonly unknown[]
-              )(inputRow, index)
-            : Array.isArray(userKeyOption)
-              ? userKeyOption.map((fieldName) => inputRow[fieldName])
-              : inputRow[String(userKeyOption)];
-        const parts = Array.isArray(raw) ? raw : [raw];
-        if (parts.some((part) => part === null || part === undefined)) {
-          throw new Error(
-            `ctx.dataset("${normalizedMapNamespace}") key returned null or undefined for row ${index}. ` +
-              'Return a non-empty string or number derived from a stable input column (e.g. row.email ?? row.domain).',
+    let rowIdentityMode: 'source_row' | 'key' = 'key';
+    let useSourceRowIdentity = false;
+    const setSourceIdentityMode = (
+      csvSource: boolean,
+    ): ((row: Record<string, unknown>, index: number) => string) | null => {
+      const csvOccurrenceIdentityRequired =
+        csvSource &&
+        this.currentRuntimeSemantics.datasets.csvRowIdentity === 'source_row';
+      rowIdentityMode = csvOccurrenceIdentityRequired
+        ? 'source_row'
+        : (options?.rowIdentity ??
+          (options?.key !== undefined
+            ? 'key'
+            : csvSource
+              ? this.currentRuntimeSemantics.datasets.csvRowIdentity
+              : 'key'));
+      useSourceRowIdentity = rowIdentityMode === 'source_row';
+      if (useSourceRowIdentity) {
+        return (row, index) => {
+          const source = getPlayDatasetSourceRowIdentity(row);
+          const inputRow = Object.fromEntries(
+            Object.entries(toSerializableCsvAliasedRow(row)).filter(
+              ([field]) => !field.startsWith('__deepline'),
+            ),
           );
-        }
-        const normalizedParts = parts.map((part) => {
-          if (typeof part === 'number') {
-            return Number.isFinite(part) ? String(part) : '';
+          // Position distinguishes equal records; the input digest prevents a
+          // changed file at the same path from replaying an earlier row's output.
+          return JSON.stringify([
+            'source-row-v1',
+            source?.datasetId ??
+              (isPlayDataset(items) ? items.datasetId : normalizedMapNamespace),
+            source?.rowIndex ?? index,
+            stableDigest(stableStringify(inputRow)),
+          ]);
+        };
+      } else if (userKeyOption !== undefined) {
+        return (row, index) => {
+          const inputRow = stripFieldOutputs(row);
+          const raw =
+            typeof userKeyOption === 'function'
+              ? (
+                  userKeyOption as (
+                    row: Record<string, unknown>,
+                    index: number,
+                  ) => string | number | readonly unknown[]
+                )(inputRow, index)
+              : Array.isArray(userKeyOption)
+                ? userKeyOption.map((fieldName) => inputRow[fieldName])
+                : inputRow[String(userKeyOption)];
+          const parts = Array.isArray(raw) ? raw : [raw];
+          if (parts.some((part) => part === null || part === undefined)) {
+            throw new Error(
+              `ctx.dataset("${normalizedMapNamespace}") key returned null or undefined for row ${index}. ` +
+                'Return a non-empty string or number derived from a stable input column (e.g. row.email ?? row.domain).',
+            );
           }
-          return String(part).trim();
-        });
-        if (normalizedParts.some((part) => !part)) {
-          throw new Error(
-            `ctx.dataset("${normalizedMapNamespace}") key returned an empty value for row ${index}. ` +
-              'Return a non-empty string or finite number derived from a stable input column.',
-          );
-        }
-        return normalizedParts.length === 1
-          ? normalizedParts[0]!
-          : JSON.stringify(normalizedParts);
-      };
-    }
+          const normalizedParts = parts.map((part) => {
+            if (typeof part === 'number') {
+              return Number.isFinite(part) ? String(part) : '';
+            }
+            return String(part).trim();
+          });
+          if (normalizedParts.some((part) => !part)) {
+            throw new Error(
+              `ctx.dataset("${normalizedMapNamespace}") key returned an empty value for row ${index}. ` +
+                'Return a non-empty string or finite number derived from a stable input column.',
+            );
+          }
+          return normalizedParts.length === 1
+            ? normalizedParts[0]!
+            : JSON.stringify(normalizedParts);
+        };
+      }
+      return null;
+    };
+    let explicitKeyResolver = setSourceIdentityMode(
+      replayMapFrame?.arrayInput?.hasSourceIdentities ?? authoredCsvSource,
+    );
 
     const rowIdentity = (row: Record<string, unknown>, index = 0) => {
       const runtimeKey = resolveMapRowOutcomeKey(row);
@@ -8612,17 +8777,115 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const mapMemoryLimits = resolveRuntimeMapMemoryLimits(
       this.#options.runtimeMapMemoryLimits,
     );
+    // A derived key is "namespace:<64 hex chars>". Admission may rebind the
+    // namespace after staging, so reserve its validated maximum up front.
+    // normalizeTableNamespace emits ASCII and caps it at this many bytes.
+    const implicitKeyReservationBytesPerRow =
+      96 + MAP_KEY_NAMESPACE_MAX_LENGTH + 1 + 64;
+    // Staged explicit-key dedupe retains a SHA-256 token, never an unbounded
+    // authored key string. The same digest primitive already names row keys.
+    const explicitKeyReservationBytesPerRow = 96 + 64;
     const materializationMemoryTracker = createRuntimeMapMaterializationTracker(
       {
         mapName: normalizedMapNamespace,
         budgetBytes: mapMemoryLimits.materializedBudgetBytes,
       },
     );
-    const shouldStreamRuntimeBackedDataset =
-      isPlayDataset<T>(items) &&
+    // Keep transport response validation at its real boundary. The maps below
+    // are local admission state, never a synthetic aggregate wire response.
+    const admitMapRows = async (
+      rows: Record<string, unknown>[],
+      tableNamespace: string,
+      mapContext: Parameters<NonNullable<ContextOptions['onMapStart']>>[2],
+      admissionBudgetBytes = mapMemoryLimits.materializedBudgetBytes,
+    ) => {
+      // Only transport paging creates cumulative response retention. Preserve
+      // the legacy single callback's existing checks. Streamed sources pass
+      // their reserved page budget; materialized admission uses the global one.
+      const retainedAdmissionMemory = this.#options.onMapStartPages
+        ? createRuntimeMapMaterializationTracker({
+            mapName: normalizedMapNamespace,
+            budgetBytes: admissionBudgetBytes,
+          })
+        : undefined;
+      const pages = this.#options.onMapStartPages
+        ? this.#options.onMapStartPages(rows, tableNamespace, mapContext)
+        : (async function* (start: NonNullable<ContextOptions['onMapStart']>) {
+            yield await start(rows, tableNamespace, mapContext);
+          })(this.#options.onMapStart!);
+      const pendingRowsByKey = new Map<string, Record<string, unknown>>();
+      const completedRowsByKey = new Map<string, Record<string, unknown>>();
+      const previousCellsByKey:
+        | ReturnType<typeof assertDatasetAdmissionHistory>
+        | undefined =
+        this.currentRuntimeContract.datasetRowInput === 'current_run'
+          ? new Map()
+          : undefined;
+      let resolvedNamespace: string | undefined;
+      for await (const result of pages) {
+        const pageNamespace = normalizeTableNamespace(result.tableNamespace);
+        if (resolvedNamespace && resolvedNamespace !== pageNamespace) {
+          throw new Error('Dataset admission pages changed table namespace.');
+        }
+        resolvedNamespace = pageNamespace;
+        // Legacy callbacks may resolve an alias and return unstamped rows.
+        // Derive their fallback keys in that resolved namespace, as before.
+        resolvedTableNamespace = pageNamespace;
+        const history = previousCellsByKey
+          ? assertDatasetAdmissionHistory(
+              result,
+              Math.floor(
+                admissionBudgetBytes /
+                  NODE_RUNTIME_MAP_MATERIALIZED_MEMORY_MULTIPLIER,
+              ),
+            )
+          : undefined;
+        for (const [key, cells] of history ?? []) {
+          if (!previousCellsByKey!.has(key)) {
+            retainedAdmissionMemory?.track({ previousCells: cells });
+            previousCellsByKey!.set(key, cells);
+          }
+        }
+        for (const [index, row] of result.pendingRows.entries()) {
+          const key =
+            resolveMapRowOutcomeKey(row) ??
+            rowIdentity(row, (mapContext.inputOffset ?? 0) + index);
+          if (
+            key &&
+            (!pendingRowsByKey.has(key) || !this.#options.onMapStartPages)
+          ) {
+            retainedAdmissionMemory?.track(row);
+            pendingRowsByKey.set(key, row);
+          }
+        }
+        for (const row of result.completedRows ?? []) {
+          const key = resolveMapRowOutcomeKey(row) ?? rowIdentity(row, 0);
+          if (
+            key &&
+            (!completedRowsByKey.has(key) || !this.#options.onMapStartPages)
+          ) {
+            retainedAdmissionMemory?.track(row);
+            completedRowsByKey.set(key, row);
+          }
+        }
+      }
+      if (!resolvedNamespace) {
+        throw new Error('Dataset admission did not return a response page.');
+      }
+      return {
+        tableNamespace: resolvedNamespace,
+        pendingRowsByKey,
+        completedRowsByKey,
+        previousCellsByKey,
+      };
+    };
+    // A pre-paging array checkpoint owns its pending authored inputs. Finish
+    // that invocation on its original replay path even if the authored array
+    // changed while the run was parked.
+    const hasRuntimeSheetControls =
       this.#options.runtimeSheetBackedMapDatasets === true &&
       Boolean(
-        this.#options.onMapStart &&
+        (this.#options.onMapStart || this.#options.onMapStartPages) &&
         this.#options.onMapRowsCompleted &&
         this.#options.baseUrl &&
         this.#options.executorToken &&
@@ -8633,8 +8896,6 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     // rebuilt in authored call order. Look up a previously suspended plan now,
     // before a stateful source query can decide that a sibling action is no
     // longer eligible because an earlier action already completed.
-    const replayMapInvocationId = `${normalizedMapNamespace}:${this.mapInvocationIndex}`;
-    const replayMapFrame = this.checkpoint.mapFrames?.[replayMapInvocationId];
     const canReadPersistedMapResults = Boolean(
       this.#options.onMapRowsCompleted &&
       this.#options.dbSessionStrategy &&
@@ -8643,6 +8904,153 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       this.#options.playName &&
       this.#options.runId,
     );
+    const sourceArrayEstimate = Array.isArray(items)
+      ? estimateRuntimeMapRowsMemory(items)
+      : null;
+    let sealedArrayInput: Extract<
+      RuntimeArrayInputManifest,
+      { state: 'sealed' }
+    > | null = null;
+    const arrayInputStore = this.#options.runtimeArrayInputStore;
+    const arrayInputScope: RuntimeArrayInputScope = {
+      playName: this.#options.playName ?? '',
+      runId: this.#options.runId ?? '',
+      tableNamespace: resolvedTableNamespace,
+      mapInvocationId: replayMapInvocationId,
+    };
+    if (
+      replayMapFrame?.arrayInput &&
+      (!Array.isArray(items) ||
+        !hasRuntimeSheetControls ||
+        !canReadPersistedMapResults ||
+        !arrayInputStore)
+    ) {
+      throw new Error(
+        `Dataset ${resolvedTableNamespace} cannot replay its sealed array input without the runtime sheet and array input reader.`,
+      );
+    }
+    if (
+      Array.isArray(items) &&
+      !(replayMapFrame?.suspendedInputRows && !replayMapFrame.arrayInput) &&
+      hasRuntimeSheetControls &&
+      canReadPersistedMapResults &&
+      arrayInputStore
+    ) {
+      let manifest: RuntimeArrayInputManifest;
+      let storeUnavailable = false;
+      try {
+        // A sealed source may predate the first checkpoint. Probe even if the
+        // current authored array is small or empty, so that intent survives a
+        // crash between sealing and the first map frame write.
+        manifest = await arrayInputStore.getManifest(arrayInputScope);
+      } catch (error) {
+        if (!(error instanceof RuntimeArrayInputStoreUnavailableError))
+          throw error;
+        if (replayMapFrame?.arrayInput) {
+          throw new Error(
+            `Dataset ${resolvedTableNamespace} requires its sealed array input, but this receiver cannot read array input pages.`,
+            { cause: error },
+          );
+        }
+        manifest = { state: 'absent' };
+        storeUnavailable = true;
+      }
+      // The sealed snapshot is the source of truth after a crash, including an
+      // explicit false. The regenerated authored array can be empty or carry
+      // different sidecars, so choose keys only after reading this manifest.
+      if (manifest.state === 'sealed') {
+        explicitKeyResolver = setSourceIdentityMode(
+          manifest.hasSourceIdentities,
+        );
+      }
+      if (manifest.state === 'absent' && replayMapFrame?.arrayInput) {
+        throw new Error(
+          `Dataset ${resolvedTableNamespace} sealed array input is missing on replay.`,
+        );
+      }
+      const stagingCandidate =
+        !storeUnavailable &&
+        (manifest.state !== 'absent' ||
+          (this.#options.runtimeArrayInputStagingEnabled === true &&
+            sourceArrayEstimate !== null &&
+            sourceArrayEstimate.estimatedResidentBytes <=
+              mapMemoryLimits.materializedBudgetBytes &&
+            sourceArrayEstimate.estimatedResidentBytes * 2 >
+              mapMemoryLimits.materializedBudgetBytes));
+      const sourceCanStageLosslessly =
+        manifest.state === 'sealed' ||
+        !stagingCandidate ||
+        items.every(
+          (item, index) =>
+            isLosslessArrayInputValue(item) &&
+            isLosslessArrayInputValue(
+              getPlayDatasetSourceRowIdentityAt(items, index) ?? null,
+            ),
+        );
+      if (manifest.state === 'staging' && !sourceCanStageLosslessly) {
+        throw new Error(
+          `Dataset ${resolvedTableNamespace} source changed before its array input was sealed. Retry with the original source.`,
+        );
+      }
+      const needsStaging = stagingCandidate && sourceCanStageLosslessly;
+      if (needsStaging) {
+        const stageKeyReservationBytes = !useSourceRowIdentity
+          ? items.length *
+            (explicitKeyResolver
+              ? explicitKeyReservationBytesPerRow
+              : implicitKeyReservationBytesPerRow)
+          : 0;
+        const stageResidentBytes =
+          (sourceArrayEstimate?.estimatedResidentBytes ?? 0) +
+          stageKeyReservationBytes;
+        if (
+          manifest.state !== 'sealed' &&
+          sourceArrayEstimate &&
+          stageResidentBytes >= mapMemoryLimits.materializedBudgetBytes
+        ) {
+          throw new RuntimeMapMemoryLimitError({
+            mapName: normalizedMapNamespace,
+            phase: 'materialize',
+            estimate: {
+              ...sourceArrayEstimate,
+              estimatedResidentBytes: stageResidentBytes,
+            },
+            budgetBytes: mapMemoryLimits.materializedBudgetBytes,
+          });
+        }
+        try {
+          sealedArrayInput = await sealRuntimeArrayInput({
+            scope: arrayInputScope,
+            rows: items,
+            store: arrayInputStore,
+            manifest,
+            maxPageMemoryBytes:
+              manifest.state === 'sealed'
+                ? undefined
+                : Math.floor(
+                    (mapMemoryLimits.materializedBudgetBytes -
+                      stageResidentBytes) /
+                      4,
+                  ),
+            normalize: (item, index) => ({
+              data: sanitizePostgresJsonValue(
+                cloneCsvAliasedRow(this.toOutputRow(item)),
+              ) as Record<string, unknown>,
+              sourceIdentity: getPlayDatasetSourceRowIdentityAt(items, index),
+            }),
+          });
+        } catch (error) {
+          if (
+            !(error instanceof RuntimeArrayInputStoreUnavailableError) ||
+            manifest.state !== 'absent'
+          )
+            throw error;
+        }
+      }
+    }
+    const shouldStreamRuntimeBackedDataset =
+      (isPlayDataset<T>(items) || sealedArrayInput !== null) &&
+      hasRuntimeSheetControls;
     // A suspended map's admitted pending inputs remain authoritative even
     // when a stateful authored source returns fewer rows after a wake.
     const suspendedInputRows = shouldStreamRuntimeBackedDataset
@@ -8698,10 +9106,77 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const isVisibleTerminalRow = (row: PersistableMapRow): boolean =>
       visibility.isVisible(row.key);
     if (shouldStreamRuntimeBackedDataset) {
+      // A caller keeps an array alive across this await. Reserve its complete
+      // resident estimate before admitting any row, then divide the remaining
+      // budget among the active page, sheet-admission copies, retained row
+      // outcomes, and the optional immediate result cache. A cursor has no
+      // resident source.
+      const arraySourceMemoryEstimate = sealedArrayInput
+        ? sourceArrayEstimate
+        : null;
+      if (
+        arraySourceMemoryEstimate &&
+        arraySourceMemoryEstimate.estimatedResidentBytes >
+          mapMemoryLimits.materializedBudgetBytes
+      ) {
+        throw new RuntimeMapMemoryLimitError({
+          mapName: normalizedMapNamespace,
+          phase: 'materialize',
+          estimate: arraySourceMemoryEstimate,
+          budgetBytes: mapMemoryLimits.materializedBudgetBytes,
+        });
+      }
+      // Both explicit and implicit first-wins keys survive page settlement.
+      // Reserve their bounded index apart from transient page allocations.
+      const keyIndexBudgetBytes =
+        sealedArrayInput && !useSourceRowIdentity
+          ? sealedArrayInput.sourceRows *
+            (explicitKeyResolver
+              ? explicitKeyReservationBytesPerRow
+              : implicitKeyReservationBytesPerRow)
+          : 0;
+      if (
+        arraySourceMemoryEstimate &&
+        arraySourceMemoryEstimate.estimatedResidentBytes +
+          keyIndexBudgetBytes >=
+          mapMemoryLimits.materializedBudgetBytes
+      ) {
+        throw new RuntimeMapMemoryLimitError({
+          mapName: normalizedMapNamespace,
+          phase: 'materialize',
+          estimate: {
+            ...arraySourceMemoryEstimate,
+            estimatedResidentBytes:
+              arraySourceMemoryEstimate.estimatedResidentBytes +
+              keyIndexBudgetBytes,
+          },
+          budgetBytes: mapMemoryLimits.materializedBudgetBytes,
+        });
+      }
+      const pageBudgetBytes = arraySourceMemoryEstimate
+        ? Math.max(
+            1,
+            Math.floor(
+              (mapMemoryLimits.materializedBudgetBytes -
+                arraySourceMemoryEstimate.estimatedResidentBytes -
+                keyIndexBudgetBytes) /
+                4,
+            ),
+          )
+        : mapMemoryLimits.materializedBudgetBytes;
       // Net-new admission happens one source page at a time. Its progress and
       // returned dataset describe admitted rows, not every provider/CSV row
       // supplied to this run, so accumulate the admitted count below.
-      totalInputCount = options?.mode === 'net_new' ? 0 : await items.count();
+      totalInputCount =
+        options?.mode === 'net_new'
+          ? 0
+          : sealedArrayInput
+            ? sealedArrayInput.sourceRows
+            : isPlayDataset(items)
+              ? await items.count()
+              : (() => {
+                  throw new Error('Runtime-backed map source is missing.');
+                })();
       const mapScope = this.createMapExecutionScope({
         logicalNamespace: normalizedMapNamespace,
         artifactTableNamespace: resolvedTableNamespace,
@@ -8713,6 +9188,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         logicalNamespace: mapScope.logicalNamespace,
         artifactTableNamespace: mapScope.artifactTableNamespace,
         status: 'running',
+        arrayInput: sealedArrayInput
+          ? { hasSourceIdentities: sealedArrayInput.hasSourceIdentities }
+          : undefined,
         totalRows: totalInputCount,
         completedRowKeys: [],
         pendingRowKeys: [],
@@ -8735,6 +9213,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       });
 
       const seenExplicitKeys = new Set<string>();
+      let seenExplicitKeyBytes = 0;
+      const seenImplicitRowKeys = new Set<string>();
+      let seenImplicitRowKeyBytes = 0;
       let processedCount = 0;
       let successfulCount = 0;
       let failedCount = 0;
@@ -8825,13 +9306,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         await flushChunk();
       };
 
-      const pipelinePages = !this.canUsePureJsMapFastPath(
-        input as MapFieldDefinition<Record<string, unknown>>,
-      );
-      const pageBudgetBytes = mapMemoryLimits.materializedBudgetBytes;
-      const persistedRowIdentity = (row: Record<string, unknown>, index = 0) =>
-        resolveMapRowOutcomeKey(row) ?? rowIdentity(row, index);
-
+      // The fed pool retains every appended row in executionRows. A staged
+      // array must release each page after settlement to honor its source
+      // reservation, including when a resolver invokes provider tools.
+      const pipelinePages =
+        !sealedArrayInput &&
+        !this.canUsePureJsMapFastPath(
+          input as MapFieldDefinition<Record<string, unknown>>,
+        );
       type PreparedPage = {
         rows: Record<string, unknown>[];
         rowKeys: string[];
@@ -8877,7 +9359,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             }),
           };
         });
-        const mapStartResult = await this.#options.onMapStart!(
+        const admission = await admitMapRows(
           pageStartRows,
           resolvedTableNamespace,
           {
@@ -8891,7 +9373,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               ? {
                   includePreviousCells: true,
                   previousCellsBudgetBytes: Math.floor(
-                    mapMemoryLimits.materializedBudgetBytes /
+                    pageBudgetBytes /
                       NODE_RUNTIME_MAP_MATERIALIZED_MEMORY_MULTIPLIER,
                   ),
                 }
@@ -8900,37 +9382,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             mode: options?.mode,
             columnTypes: unchangedColumnTypes,
           },
+          pageBudgetBytes,
         );
-        resolvedTableNamespace = normalizeTableNamespace(
-          mapStartResult.tableNamespace,
-        );
-        const previousCellsByKey =
-          this.currentRuntimeContract.datasetRowInput === 'current_run'
-            ? assertDatasetAdmissionHistory(
-                mapStartResult,
-                Math.floor(
-                  mapMemoryLimits.materializedBudgetBytes /
-                    NODE_RUNTIME_MAP_MATERIALIZED_MEMORY_MULTIPLIER,
-                ),
-              )
-            : undefined;
-
-        const pendingRowsByKey = new Map<string, Record<string, unknown>>();
-        for (
-          let index = 0;
-          index < mapStartResult.pendingRows.length;
-          index += 1
-        ) {
-          const row = mapStartResult.pendingRows[index]!;
-          const rowKey = persistedRowIdentity(row, page.offset + index);
-          if (rowKey) pendingRowsByKey.set(rowKey, row);
-        }
-        const completedRowsByKey = new Map<string, Record<string, unknown>>();
-        for (const row of mapStartResult.completedRows ?? []) {
-          const rowKey = persistedRowIdentity(row);
-          if (!rowKey) continue;
-          completedRowsByKey.set(rowKey, row);
-        }
+        resolvedTableNamespace = admission.tableNamespace;
+        const { pendingRowsByKey, completedRowsByKey, previousCellsByKey } =
+          admission;
 
         const seededItems = pageRawItems.map((row, index) => {
           const originalIndex = page.offset + index;
@@ -8964,14 +9420,64 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         for (const { row, index } of admittedSeededItems) {
           if (explicitKeyResolver && !useSourceRowIdentity) {
             const explicitKey = explicitKeyResolver(row, index);
-            if (seenExplicitKeys.has(explicitKey)) {
+            const dedupeToken = sealedArrayInput
+              ? sha256Hex(explicitKey)
+              : explicitKey;
+            if (seenExplicitKeys.has(dedupeToken)) {
               duplicateReuseCount += 1;
               processedCount += 1;
               continue;
             }
-            seenExplicitKeys.add(explicitKey);
+            if (sealedArrayInput) {
+              seenExplicitKeyBytes +=
+                96 + Buffer.byteLength(dedupeToken, 'utf8');
+              if (seenExplicitKeyBytes > keyIndexBudgetBytes) {
+                throw new RuntimeMapMemoryLimitError({
+                  mapName: normalizedMapNamespace,
+                  phase: 'materialize',
+                  estimate: {
+                    ...(arraySourceMemoryEstimate ??
+                      estimateRuntimeMapRowsMemory([])),
+                    estimatedResidentBytes:
+                      (arraySourceMemoryEstimate?.estimatedResidentBytes ?? 0) +
+                      seenExplicitKeyBytes +
+                      pageBudgetBytes * 4,
+                  },
+                  budgetBytes: mapMemoryLimits.materializedBudgetBytes,
+                });
+              }
+            }
+            seenExplicitKeys.add(dedupeToken);
           }
           const rowKey = rowIdentity(row, index);
+          if (
+            sealedArrayInput &&
+            !explicitKeyResolver &&
+            !useSourceRowIdentity
+          ) {
+            if (seenImplicitRowKeys.has(rowKey)) {
+              duplicateReuseCount += 1;
+              processedCount += 1;
+              continue;
+            }
+            seenImplicitRowKeyBytes += 96 + Buffer.byteLength(rowKey, 'utf8');
+            if (seenImplicitRowKeyBytes > keyIndexBudgetBytes) {
+              throw new RuntimeMapMemoryLimitError({
+                mapName: normalizedMapNamespace,
+                phase: 'materialize',
+                estimate: {
+                  ...(arraySourceMemoryEstimate ??
+                    estimateRuntimeMapRowsMemory([])),
+                  estimatedResidentBytes:
+                    (arraySourceMemoryEstimate?.estimatedResidentBytes ?? 0) +
+                    seenImplicitRowKeyBytes +
+                    pageBudgetBytes * 4,
+                },
+                budgetBytes: mapMemoryLimits.materializedBudgetBytes,
+              });
+            }
+            seenImplicitRowKeys.add(rowKey);
+          }
           if (!rowsToExecuteByKey.has(rowKey)) {
             rowsToExecuteByKey.set(rowKey, { row, originalIndex: index });
           } else {
@@ -9054,6 +9560,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           logicalNamespace: mapScope.logicalNamespace,
           artifactTableNamespace: resolvedTableNamespace,
           status: 'running',
+          arrayInput: sealedArrayInput
+            ? { hasSourceIdentities: sealedArrayInput.hasSourceIdentities }
+            : undefined,
           totalRows: totalInputCount,
           completedRowKeys: [],
           pendingRowKeys: execution.rowFeed ? [] : [...execution.rowKeys],
@@ -9094,8 +9603,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               progressSkippedOffset: () => duplicateReuseCount,
               progressTotalRows: () => totalInputCount,
               rowFeed: execution.rowFeed,
-              retainedRowsMemoryBudgetBytes:
-                mapMemoryLimits.materializedBudgetBytes,
+              retainedRowsMemoryBudgetBytes: pageBudgetBytes,
               incrementalPersistence,
               releasePersistedRowsOnMemoryPressure: true,
             },
@@ -9181,9 +9689,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     (observedResidentBytes / observedRowCount) *
                       Math.max(observedRowCount, totalInputCount - failedCount),
                   );
-            if (
-              projectedResidentBytes > mapMemoryLimits.materializedBudgetBytes
-            ) {
+            if (projectedResidentBytes > pageBudgetBytes) {
               // All-or-nothing cache: retaining a prefix that cannot fit once
               // the known input finishes gives authored code no complete fast
               // path. More importantly, that prefix would overlap the next
@@ -9192,7 +9698,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               // rows observed so far and move to the already-durable sheet
               // early instead of waiting for resident memory to reach a cliff.
               disableImmediateMaterializedCache(
-                `projected ${projectedResidentBytes} bytes exceeds ${mapMemoryLimits.materializedBudgetBytes}-byte budget`,
+                `projected ${projectedResidentBytes} bytes exceeds ${pageBudgetBytes}-byte result cache budget`,
               );
             } else {
               immediateMaterializedRows.push(materializedRow);
@@ -9216,13 +9722,83 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         processedCount += execution.rows.length;
       };
 
-      const sourcePages = iteratePlayDatasetInputPages(items, {
-        maxPageBytes: pageBudgetBytes,
-        estimateRowBytes: (row) =>
-          runtimeMapJsonByteLength(row) *
-            NODE_RUNTIME_MAP_MATERIALIZED_MEMORY_MULTIPLIER +
-          NODE_RUNTIME_MAP_ROW_OVERHEAD_BYTES,
-      });
+      const sourcePages = iteratePlayDatasetInputPages<T>(
+        sealedArrayInput
+          ? (iterateSealedRuntimeArrayInput(
+              arrayInputStore!,
+              arrayInputScope,
+              sealedArrayInput,
+            ) as AsyncIterable<T>)
+          : items,
+        {
+          maxPageBytes: pageBudgetBytes,
+          estimateRowBytes: (item, index, sourceIdentity) => {
+            // The legacy single callback's final guard prices raw rows. Keep
+            // its existing cuts; only current-run seeding or paged retention
+            // introduces the execution/admission shapes accounted below.
+            if (
+              this.currentRuntimeContract.datasetRowInput !== 'current_run' &&
+              !this.#options.onMapStartPages
+            ) {
+              return (
+                runtimeMapJsonByteLength(item) *
+                  NODE_RUNTIME_MAP_MATERIALIZED_MEMORY_MULTIPLIER +
+                NODE_RUNTIME_MAP_ROW_OVERHEAD_BYTES
+              );
+            }
+            const row = this.toOutputRow(item as Record<string, unknown>);
+            if (sourceIdentity) {
+              setPlayDatasetSourceRowIdentity(row, sourceIdentity);
+            }
+            // Estimate the execution shape before any admission side effect.
+            // Reserve a derived key's maximum namespace without invoking an
+            // authored key resolver a second time. History never changes page
+            // cuts; its returned values must fit this same fixed page budget.
+            const stamped = {
+              ...toSerializableCsvAliasedRow(row),
+              ...(sourceIdentity
+                ? { __deeplineSourceRow: sourceIdentity }
+                : {}),
+              ...mapRowOutcomeRuntimeFields({
+                key:
+                  resolveMapRowOutcomeKey(row) ??
+                  'x'.repeat(MAP_KEY_NAMESPACE_MAX_LENGTH + 1 + 64),
+                inputIndex: index,
+              }),
+            };
+            const seeded = this.datasetRowInputs.seed(
+              row,
+              stamped,
+              this.currentRuntimeContract.datasetRowInput,
+            );
+            const executionEstimate = estimateRuntimeMapRowsMemory([
+              this.datasetRowInputs.memoryValue(seeded),
+            ]);
+            // Paged admission retains the stamped row and an independent
+            // history-map entry before seeding. Cover both existing trackers.
+            const admissionEstimate = estimateRuntimeMapRowsMemory([
+              stamped,
+              ...(this.currentRuntimeContract.datasetRowInput === 'current_run'
+                ? [{ previousCells: {} }]
+                : []),
+            ]);
+            const estimate =
+              executionEstimate.estimatedResidentBytes >
+              admissionEstimate.estimatedResidentBytes
+                ? executionEstimate
+                : admissionEstimate;
+            if (estimate.estimatedResidentBytes > pageBudgetBytes) {
+              throw new RuntimeMapMemoryLimitError({
+                mapName: normalizedMapNamespace,
+                phase: 'materialize',
+                estimate,
+                budgetBytes: pageBudgetBytes,
+              });
+            }
+            return estimate.estimatedResidentBytes;
+          },
+        },
+      );
 
       if (pipelinePages) {
         // One worker pool for the whole source. Once page N's last row has
@@ -9327,6 +9903,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           logicalNamespace: mapScope.logicalNamespace,
           artifactTableNamespace: resolvedTableNamespace,
           status: 'failed',
+          arrayInput: sealedArrayInput
+            ? { hasSourceIdentities: sealedArrayInput.hasSourceIdentities }
+            : undefined,
           totalRows: totalInputCount,
           completedRowKeys: [],
           pendingRowKeys: [],
@@ -9370,6 +9949,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         logicalNamespace: mapScope.logicalNamespace,
         artifactTableNamespace: resolvedTableNamespace,
         status: 'completed',
+        arrayInput: sealedArrayInput
+          ? { hasSourceIdentities: sealedArrayInput.hasSourceIdentities }
+          : undefined,
         totalRows: totalInputCount,
         completedRowKeys: [],
         pendingRowKeys: [],
@@ -9620,12 +10202,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     // counts, sheet writes, resumable keys) consistent — the resolver derives
     // keys from row content, so dropped rows are excluded everywhere with no
     // index mismatch. Replaces the prior throw-on-duplicate behavior.
+    const materializedKeyResolver = explicitKeyResolver;
     const dedupedMaterialized =
-      explicitKeyResolver && !useSourceRowIdentity
+      materializedKeyResolver && !useSourceRowIdentity
         ? dedupeExplicitMapKeyRows({
             rows: rawMaterializedItems,
             resolver: (item, index) =>
-              explicitKeyResolver(
+              materializedKeyResolver(
                 this.toOutputRow(item as Record<string, unknown>),
                 originalInputIndexByItem.get(item) ?? index,
               ),
@@ -9796,7 +10379,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       (item, index) => originalInputIndexByItem.get(item) ?? index,
     );
     const mapStartSeedRowsByKey = new Map<string, Record<string, unknown>>();
-    if (this.#options.onMapStart) {
+    if (this.#options.onMapStart || this.#options.onMapStartPages) {
       // ALWAYS stamp the canonical seed row key — including no-explicit-key
       // datasets — using seedRowIdentity (full-input-row hash, matching the
       // server's own derivation). Without the stamp, seed and completion keys
@@ -9832,7 +10415,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           }),
         };
       });
-      const mapStartResult = await this.#options.onMapStart(
+      const admission = await admitMapRows(
         mapStartRows,
         resolvedTableNamespace,
         {
@@ -9855,35 +10438,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           columnTypes: unchangedColumnTypes,
         },
       );
-      resolvedTableNamespace = normalizeTableNamespace(
-        mapStartResult.tableNamespace,
-      );
-      const previousCellsByKey =
-        this.currentRuntimeContract.datasetRowInput === 'current_run'
-          ? assertDatasetAdmissionHistory(
-              mapStartResult,
-              Math.floor(
-                mapMemoryLimits.materializedBudgetBytes /
-                  NODE_RUNTIME_MAP_MATERIALIZED_MEMORY_MULTIPLIER,
-              ),
-            )
-          : undefined;
-      const persistedRowIdentity = (row: Record<string, unknown>, index = 0) =>
-        resolveMapRowOutcomeKey(row) ?? rowIdentity(row, index);
-      const pendingRowsByKey = new Map<string, Record<string, unknown>>();
-      for (
-        let index = 0;
-        index < mapStartResult.pendingRows.length;
-        index += 1
-      ) {
-        const row = mapStartResult.pendingRows[index]!;
-        const rowKey = persistedRowIdentity(row, index);
-        if (rowKey) pendingRowsByKey.set(rowKey, row);
-      }
-      for (const row of mapStartResult.completedRows ?? []) {
-        const rowKey = persistedRowIdentity(row);
-        if (!rowKey) continue;
-        mapStartSeedRowsByKey.set(rowKey, row);
+      resolvedTableNamespace = admission.tableNamespace;
+      const { pendingRowsByKey, previousCellsByKey } = admission;
+      for (const [key, row] of admission.completedRowsByKey) {
+        mapStartSeedRowsByKey.set(key, row);
       }
       const seededItems = materializedItems
         .map((item, index) => ({
@@ -10815,6 +11373,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       : Math.min(items.length, requestedRowConcurrency);
     const heapAdmission = createRuntimeMapHeapAdmission({
       maxConcurrency: rowConcurrencyLimit,
+      // The resolver above already rejects invalid supplied run maxima.
+      // Share its authored-width predicate so invalid internal widths cannot
+      // turn an automatic map into a requested missing-probe bypass.
+      concurrencySource:
+        hasExplicitRowConcurrency(this.#options.maxConcurrentRows) ||
+        hasExplicitRowConcurrency(runtimeOptions?.concurrency)
+          ? 'requested'
+          : 'automatic',
       memoryLedger: this.memoryLedger,
       ...(this.#options.runtimeMapHeapProbe
         ? { heapProbe: this.#options.runtimeMapHeapProbe }
@@ -10833,7 +11399,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     // composes the existing capacity boundaries and returns them in reverse at
     // the row's durable/in-memory handoff below.
     const mapRowFlow = createRuntimeFlow<{
-      baseRow: Record<string, unknown>;
+      inputRow: T | Record<string, unknown>;
     }>({
       stages: [
         {
@@ -10842,10 +11408,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         },
         {
           name: 'run-row',
-          acquire: async ({ baseRow }) =>
+          acquire: async ({ inputRow }) =>
             await this.resourceGovernor.acquireRow({
+              // The source is already resident in the collected baseline or
+              // accounted source page. Preserve this measurement as telemetry;
+              // reserving it again would double-charge its existing bytes.
               estimatedBytes: runtimeMapJsonByteLength(
-                this.datasetRowInputs.memoryValue(baseRow),
+                this.datasetRowInputs.memoryValue(this.toOutputRow(inputRow)),
               ),
             }),
         },
@@ -11439,48 +12008,60 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           const waitingRow = providerRetry
             ? waitingBaseRows.get(idx)
             : undefined;
-          const baseRow = providerRetry
-            ? waitingRow?.baseRow
-            : this.toOutputRow(items[idx]);
-          if (!baseRow) {
+          if (providerRetry && !waitingRow?.baseRow) {
             throw new Error(
               `Provider retry row ${idx} lost its resumable input.`,
             );
           }
-          historyRow = baseRow;
-          if (this.currentRuntimeContract.datasetRowInput === 'current_run') {
-            activeRowHistories.set(idx, baseRow);
-            this.datasetRowInputs.retain(baseRow, this.memoryLedger);
-          }
-          if (providerRetry) waitingBaseRows.delete(idx);
-          else releaseDispatchedInputRow?.(idx);
-          const callIndexes =
-            waitingRow?.callIndexes ?? new RowReplayCallIndexes();
-          callIndexes.resetAttempt();
-          const retryAfterRelease = {
-            pending: null as ProviderRowRetry | null,
-            callIndexes,
-          };
-          settledResults[idx] = await mapRowFlow.run({ baseRow }, async () => {
+          const inputRow = waitingRow?.baseRow ?? items[idx];
+          const rowAttempt: { retry?: ProviderRowRetry } = {};
+          settledResults[idx] = await mapRowFlow.run({ inputRow }, async () => {
             this.assertRowAdmissionOpen();
+            // Heap and run-row admission precede retaining per-row history or
+            // replay state. Workers waiting for capacity retain only their
+            // index and the already-resident input reference.
+            const baseRow = providerRetry
+              ? waitingRow?.baseRow
+              : this.toOutputRow(inputRow);
+            if (!baseRow) {
+              throw new Error(
+                `Provider retry row ${idx} lost its resumable input.`,
+              );
+            }
+            historyRow = baseRow;
+            if (this.currentRuntimeContract.datasetRowInput === 'current_run') {
+              activeRowHistories.set(idx, baseRow);
+              this.datasetRowInputs.retain(baseRow, this.memoryLedger);
+            }
+            if (providerRetry) waitingBaseRows.delete(idx);
+            else releaseDispatchedInputRow?.(idx);
+            const callIndexes =
+              waitingRow?.callIndexes ?? new RowReplayCallIndexes();
+            callIndexes.resetAttempt();
+            const retryAfterRelease = {
+              pending: null as ProviderRowRetry | null,
+              callIndexes,
+            };
             mapProgress.resolverStarted({ retry: Boolean(providerRetry) });
             try {
-              return await runRow(idx, baseRow, retryAfterRelease);
+              const result = await runRow(idx, baseRow, retryAfterRelease);
+              rowAttempt.retry = retryAfterRelease.pending ?? undefined;
+              return result;
             } finally {
               mapProgress.resolverFinished();
             }
           });
           // Publish only after both flow leases have returned. Another worker
           // must never re-admit this index while the old attempt is unwinding.
-          if (retryAfterRelease.pending) {
-            if (retryAfterRelease.pending.residentWaitBudgetExhausted) {
-              parkedProviderRows.add(retryAfterRelease.pending);
+          if (rowAttempt.retry) {
+            if (rowAttempt.retry.residentWaitBudgetExhausted) {
+              parkedProviderRows.add(rowAttempt.retry);
             } else {
-              providerRowRetries.add(retryAfterRelease.pending);
+              providerRowRetries.add(rowAttempt.retry);
             }
             rowFeed?.wakeWorkersAt(nextProviderRetry(true)!.readyAtMs);
           } else if (settledResults[idx] !== WAITING_ROW) {
-            this.datasetRowInputs.release(baseRow);
+            if (historyRow) this.datasetRowInputs.release(historyRow);
             providerIdleWaitStartedAt = null;
           }
           if (mapProgress.activeResolvers === 0) retryWakeFeed.wakeWorkers();
@@ -11501,6 +12082,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
       }
     });
 
+    const unregisterExternalPressure =
+      this.currentExecutionGovernor.registerExternalExecutionPressure?.({
+        read: () => heapAdmission.readExternalExecutionPressure(),
+        subscribe: (changed) =>
+          heapAdmission.subscribeExternalExecutionPressure(changed),
+      }) ?? (() => {});
     let settled: PromiseSettledResult<void>[];
     try {
       // Drain queued work but exit early if a suspension error occurs.
@@ -11580,6 +12167,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
         settled = await Promise.allSettled(workers);
       }
     } finally {
+      unregisterExternalPressure();
       clearInterval(mapActivityTimer);
       retryWakeFeed.wakeWorkers();
       publishMapActivity();
@@ -16242,7 +16830,23 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
 
   /** Aggregate waits and residence from this logical run for terminal diagnostics. */
   getRuntimeResourceSnapshot(): RuntimeResourceSnapshot {
-    return this.resourceGovernor.snapshot();
+    const body = this.providerResponseBodyGate.snapshot();
+    return {
+      ...this.resourceGovernor.snapshot(),
+      memoryAdmission: {
+        toolResponseBody: {
+          turns: body.turns,
+          measuredTurns: body.measuredTurns,
+          decodedUtf8BytesTotal: body.bytesMeasured,
+          decodedUtf8BytesMax: body.bytesMeasuredMax,
+          permitBytesPeak: body.bytesHeldPeak,
+          queuedTurns: body.queuedTurns,
+          budgetRefusals: body.holds,
+          progressAdmissions: body.progressAdmissions,
+          unpricedAdmissions: body.unpricedAdmissions,
+        },
+      },
+    };
   }
 
   /** Attempt-local counts without serializing the diagnostic resource map. */
@@ -16728,150 +17332,73 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
     const { toolId, requests } = input;
     if (requests.length === 0) return [];
 
+    // Admit receipt and presentation identities once. Provider invocation
+    // identity remains the execution Adapter's existing request contract.
+    // Canonical cache force differs from authored request.force on replay.
+    const members = requests.map((request) => ({
+      memberId: request.callId,
+      ...this.mappedToolResultReceiptPolicy(request),
+      cacheKey: request.cacheKey,
+      receiptKey: request.receiptKey!,
+      forceFailedRefresh: request.forceFailedRefresh === true,
+      waitMaxAttempts: resolveRuntimeToolReceiptWaitMaxAttempts(
+        typeof request.receiptWaitMs === 'number'
+          ? { max_wait_ms: request.receiptWaitMs }
+          : request.input,
+      ),
+      request,
+    }));
     const requestForReceipt = new Map<string, ToolCallRequest>();
     const requestsForReceipt = new Map<string, ToolCallRequest[]>();
     const requestByCallId = new Map<string, ToolCallRequest>();
-    for (const request of requests) {
-      const receiptKey =
-        this.mappedToolResultReceiptPolicy(request).resultReceiptKey;
-      requestForReceipt.set(receiptKey, request);
-      const shared = requestsForReceipt.get(receiptKey);
-      if (shared) shared.push(request);
-      else requestsForReceipt.set(receiptKey, [request]);
-      requestByCallId.set(request.callId, request);
-    }
-
-    const store = this.createRuntimeStepToolCallReceiptCohortStore({
-      toolId,
-      requestForReceipt,
-      requestsForReceipt,
-    });
-
-    const cohort = await createToolCallReceiptCohortJob({
-      store,
-      timings: this.toolCallReceiptCohortTimings(requestByCallId),
-    }).acquire({
-      owner: {
-        runId: this.currentReceiptOwnerRunId,
-        attempt: this.currentRunAttempt,
-      },
-      members: requests.map((request) => ({
-        memberId: request.callId,
-        ...this.mappedToolResultReceiptPolicy(request),
-        forceFailedRefresh: request.forceFailedRefresh === true,
-        waitMaxAttempts: resolveRuntimeToolReceiptWaitMaxAttempts(
-          typeof request.receiptWaitMs === 'number'
-            ? { max_wait_ms: request.receiptWaitMs }
-            : request.input,
-        ),
-      })),
-    });
-
-    const successful: ToolCallRequest[] = [];
-    const resolve = async (
-      request: ToolCallRequest,
-      result: ToolExecuteResult,
-      source: 'cache' | 'owner',
-    ): Promise<void> => {
-      const receiptKey = request.receiptKey!;
-      const finalResult = cloneToolExecuteResultWithExecution(result, {
-        ...toolExecutionMetadataForOutcome({
-          kind: source === 'owner' ? 'live' : source,
-          cacheKey: request.cacheKey,
-          receiptKey,
-          ...(source === 'owner' ? {} : { attachedToReceiptKey: receiptKey }),
-        }),
-        resultReceiptKey:
-          this.mappedToolResultReceiptPolicy(request).resultReceiptKey,
-      });
-      this.cacheToolResult(toolId, request.cacheKey, finalResult);
-      const resolver = this.toolCallResolvers.get(request.callId);
-      if (resolver) {
-        resolver.resolve(finalResult);
-        this.toolCallResolvers.delete(request.callId);
-      }
-      this.emitScopedFieldMetaUpdate({
-        rowId: request.rowId,
-        key: request.rowKey ?? null,
-        tableNamespace: request.tableNamespace ?? null,
-        fieldName: request.fieldName,
-        status: source === 'owner' ? 'running' : 'cached',
-        rowStatus: 'running',
-        stage: toolId,
-        provider: null,
-        error: null,
-        ...(source === 'owner' ? {} : { reused: true }),
-        dataPatch: {},
-      });
-      successful.push(request);
-    };
-    const reject = async (request: ToolCallRequest, error: unknown) => {
-      await this.rejectToolCall(toolId, request, error, {
-        // Failures are never cache entries, including failed local misses.
-        persistReceiptFailure: false,
-      });
-    };
-
-    const cachedResults: Promise<void>[] = [];
-    const owned: Array<{
-      request: ToolCallRequest;
-      receipts: ToolResultReceipts;
-    }> = [];
-    for (const request of requests) {
-      const member = cohort.member(request.callId);
-      if (member.kind === 'completed') {
-        cachedResults.push(resolve(request, member.result, member.source));
-      } else if (member.kind === 'owned') {
-        owned.push({ request, receipts: member.receipts });
-      } else {
-        throw new Error(
-          'A completed-result cache cannot own a pending invocation.',
-        );
-      }
-    }
-
-    const width = Math.min(
-      this.governor.policy.concurrency.toolCalls,
-      Math.max(
-        1,
-        await this.resourceGovernor.suggestedToolParallelism(
+    for (const member of members) {
+      requestForReceipt.set(member.resultReceiptKey, member.request);
+      const shared = requestsForReceipt.get(member.resultReceiptKey);
+      if (shared) shared.push(member.request);
+      else requestsForReceipt.set(member.resultReceiptKey, [member.request]);
+      requestByCallId.set(member.memberId, member.request);
+    }
+    const calls = createMappedToolCallJob<ToolCallRequest>({
+      receiptCohort: createToolCallReceiptCohortJob({
+        store: this.createRuntimeStepToolCallReceiptCohortStore({
           toolId,
-          this.governor.policy.concurrency.toolCalls,
-        ),
-      ),
-    );
-    await dispatchBoundedSettled(
-      owned,
-      width,
-      async ({ request, receipts }) => {
-        // Circuit breaker: do not dispatch this provider call once a
-        // persistence failure has occurred in this run. Rejected through the
-        // same path as a provider failure — `dispatchBoundedSettled` only
-        // collects a thrown error, so throwing past `reject` here would
-        // leave this row's tool-call resolver pending for the life of the
-        // map.
-        if (this.persistenceLatch.tripped) {
+          requestForReceipt,
+          requestsForReceipt,
+        }),
+        timings: this.toolCallReceiptCohortTimings(requestByCallId),
+      }),
+      admission: {
+        parallelism: async () =>
+          Math.min(
+            this.governor.policy.concurrency.toolCalls,
+            Math.max(
+              1,
+              await this.resourceGovernor.suggestedToolParallelism(
+                toolId,
+                this.governor.policy.concurrency.toolCalls,
+              ),
+            ),
+          ),
+        assertDispatchAllowed: () => {
+          if (!this.persistenceLatch.tripped) return;
           this.persistenceLatch.preventedCallCount += 1;
-          await reject(
-            request,
-            new RuntimePersistenceCircuitOpenError(this.persistenceLatch),
-          );
-          return;
-        }
-        let releaseToolSlot: () => void = () => undefined;
-        try {
+          throw new RuntimePersistenceCircuitOpenError(this.persistenceLatch);
+        },
+      },
+      execution: {
+        call: async ({ member, receipts, retainToolSlot }) => {
+          const request = member.request;
           const providerOperationKey = this.providerInvocationKeyForToolCall({
             operationKey:
               request.providerIdempotencyKeyBase ?? request.receiptKey!,
             logicalCallId: request.logicalCallId,
             force: request.force,
           });
-          const result = await this.executeMappedToolCallThroughModule({
+          return this.executeMappedToolCallThroughModule({
             request,
             dispatchToolId: toolId,
             dispatchPayload: request.input,
-            resultReceiptKey:
-              this.mappedToolResultReceiptPolicy(request).resultReceiptKey,
+            resultReceiptKey: member.resultReceiptKey,
             providerOperationKey,
             resultReceipts: receipts,
             apiOptions: {
@@ -16910,22 +17437,52 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 typeof request.timeoutMs === 'number' && request.timeoutMs > 0
                   ? request.timeoutMs
                   : undefined,
-              retainToolSlot: (release) => {
-                releaseToolSlot = release;
-              },
+              retainToolSlot,
             },
           });
-          await resolve(request, result, 'owner');
-        } catch (error) {
-          await reject(request, error);
-        } finally {
-          releaseToolSlot();
-        }
+        },
+      },
+      delivery: {
+        complete: async ({ member, result, source }) => {
+          const request = member.request;
+          this.cacheToolResult(toolId, member.cacheKey, result);
+          const resolver = this.toolCallResolvers.get(member.memberId);
+          if (resolver) {
+            resolver.resolve(result);
+            this.toolCallResolvers.delete(member.memberId);
+          }
+          this.emitScopedFieldMetaUpdate({
+            rowId: request.rowId,
+            key: request.rowKey ?? null,
+            tableNamespace: request.tableNamespace ?? null,
+            fieldName: request.fieldName,
+            status: source === 'owner' ? 'running' : 'cached',
+            rowStatus: 'running',
+            stage: toolId,
+            provider: null,
+            error: null,
+            ...(source === 'owner' ? {} : { reused: true }),
+            dataPatch: {},
+          });
+        },
+        fail: async ({ member, error }) => {
+          await this.rejectToolCall(toolId, member.request, error, {
+            // A failure never replaces an immutable successful cache entry.
+            persistReceiptFailure: false,
+          });
+        },
+      },
+    });
+    const { successfulMemberIds } = await calls.call({
+      owner: {
+        runId: this.currentReceiptOwnerRunId,
+        attempt: this.currentRunAttempt,
       },
+      members,
+    });
+    return successfulMemberIds.map(
+      (memberId) => requestByCallId.get(memberId)!,
     );
-
-    await Promise.all(cachedResults);
-    return successful;
   }
 
   /**
@@ -19148,8 +19705,14 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
           // the current checkpoint cursor index belongs to a newer batch.
           const providerResidentWaitKey = durableCallReceiptKey;
           let transportAttempt = 0;
+          let connectFailures = 0;
+          let firstConnectFailureAtMs: number | null = null;
           let invocationAttempt =
             savedProviderRetryCursor?.invocationAttempt ?? 0;
+          // The no-send claim covers the whole logical call, including
+          // deliveries made before a checkpoint resume.
+          let earlierDeliveryMayHaveArrived =
+            savedProviderRetryCursor !== undefined || invocationAttempt > 0;
           clearProviderRetryCursor = () => {
             if (providerResidentWaitKey)
               this.exhaustedProviderResidentWaitCalls.delete(
@@ -19271,8 +19834,21 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             aborted: boolean;
             /** The ingress rejected the request before any provider dispatch. */
             knownNotDispatched?: boolean;
+            /** No socket existed, so no byte of the request was written. */
+            connectionNeverOpened?: boolean;
           }): Promise<void> => {
-            transportAttempt += 1;
+            if (!input.connectionNeverOpened)
+              earlierDeliveryMayHaveArrived = true;
+            let connectRetryDelayMs: number | null = null;
+            if (input.connectionNeverOpened) {
+              connectFailures += 1;
+              firstConnectFailureAtMs ??= Date.now();
+              connectRetryDelayMs = toolExecuteConnectRetryDelayMs({
+                failures: connectFailures,
+                elapsedMs: Date.now() - firstConnectFailureAtMs,
+              });
+            }
+            if (connectRetryDelayMs === null) transportAttempt += 1;
             const diagnostic = describeTransportError(input.error);
             this.runtimeLog(
               `[runtime.transport_failure] ${JSON.stringify({
@@ -19283,9 +19859,23 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 elapsed_ms: input.elapsedMs,
                 request_id: input.requestId,
                 aborted: input.aborted,
+                connection_never_opened: input.connectionNeverOpened === true,
                 error: diagnostic,
               })}`,
             );
+            if (connectRetryDelayMs !== null) {
+              // Nothing reached the gateway, so this is neither a provider
+              // attempt nor a charged retry: the logical attempt stays as it was.
+              span.setAttribute(
+                'plays.connect_retry_failures',
+                connectFailures,
+              );
+              this.runtimeLog(
+                `Tool ${toolId} could not open a connection for ${url}; this attempt sent no request; retrying after ${connectRetryDelayMs}ms: ${diagnostic.message ?? 'unknown transport error'}`,
+              );
+              await waitForToolRetry(connectRetryDelayMs, false);
+              return;
+            }
             if (
               transportAttempt < TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS &&
               (input.knownNotDispatched === true ||
@@ -19318,7 +19908,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
             }
             throw createToolHttpError(
               toolErrorSchemaVersion,
-              `Tool ${toolId} transport failed calling ${url} after ${transportAttempt}/${TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS} attempts: ${diagnostic.message ?? 'unknown transport error'}`,
+              input.connectionNeverOpened
+                ? // Only these attempts are proven; a delivery before a resume
+                  // leaves no trace in this process, so never claim the call.
+                  `Tool ${toolId} could not open a connection for ${url} before the retry window closed. These connection attempts sent no request${earlierDeliveryMayHaveArrived ? ', but an earlier attempt of this call may have reached the provider' : ''}: ${diagnostic.message ?? 'unknown transport error'}`
+                : `Tool ${toolId} transport failed calling ${url} after ${transportAttempt}/${TOOL_EXECUTE_TRANSPORT_MAX_ATTEMPTS} attempts: ${diagnostic.message ?? 'unknown transport error'}`,
               null,
               0,
               'repairable',
@@ -19775,6 +20369,10 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                               : url,
                             {
                               method: 'POST',
+                              // A followed redirect could fail to connect after
+                              // this POST was delivered, which would look like
+                              // a request that was never sent.
+                              redirect: 'manual',
                               signal: abortController?.signal,
                               headers: {
                                 'Content-Type': 'application/json',
@@ -19939,6 +20537,11 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                                   // graph; the row-scoped body handle below then
                                   // owns the measured value after this turn ends.
                                   bodyTurn.settleBytes(responseBodyBytes);
+                                  const bodyWork =
+                                    bodyTurn.waitForCooperativeWork?.(
+                                      abortController?.signal,
+                                    );
+                                  if (bodyWork) await bodyWork;
                                   const transportBytes =
                                     this.memoryLedger.register({
                                       category: 'transportInFlight',
@@ -19964,6 +20567,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                                     nativeBatchBodyAttribution,
                                   );
                                 },
+                                abortController?.signal,
                               );
                             providerBodyAdmissionWaitMs += bodyRead.waitMs;
                           } else {
@@ -19992,7 +20596,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                                       error,
                                     );
                                   }
+                                  const bodyWork =
+                                    bodyTurn.waitForCooperativeWork?.(
+                                      abortController?.signal,
+                                    );
+                                  if (bodyWork) await bodyWork;
                                 },
+                                abortController?.signal,
                               );
                             providerBodyAdmissionWaitMs += bodyRead.waitMs;
                           }
@@ -20342,8 +20952,12 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   402,
                 );
               }
+              const connectionNeverOpened =
+                response === null &&
+                transportFailureProvesRequestNeverSent(transportError);
               const ambiguousDispatchedFailure =
                 fetchDispatched &&
+                !connectionNeverOpened &&
                 (response === null ||
                   error instanceof ToolExecuteResponseBodyTransportError ||
                   error instanceof ToolExecuteInvalidJsonError);
@@ -20412,6 +21026,7 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                     : Date.now() - providerCallStartedAt,
                 requestId: deeplineRequestId,
                 aborted: abortController?.signal.aborted === true,
+                connectionNeverOpened,
               });
               continue;
             } finally {
@@ -20426,6 +21041,9 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                 `Tool ${toolId} transport completed without an HTTP response.`,
               );
             }
+            connectFailures = 0;
+            firstConnectFailureAtMs = null;
+            earlierDeliveryMayHaveArrived = true;
             span.setAttribute('plays.http_status_code', response.status);
 
             if (providerPermitReceiverRejected) {
@@ -20451,6 +21069,17 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               );
             }
 
+            if (response.status >= 300 && response.status < 400) {
+              const location = response.headers.get('location');
+              throw createToolHttpError(
+                toolErrorSchemaVersion,
+                `Tool ${toolId} was redirected to ${location ? transportGatewayOriginForDiagnostic(location) : '<none>'}; tool execution refuses redirects, so the outcome of this call is unknown.`,
+                null,
+                response.status,
+                'repairable',
+              );
+            }
+
             if (!response.ok) {
               const text = responseErrorText ?? '';
               const recoveryKey = asyncRecoveryKey(invocationAttempt);
@@ -20683,10 +21312,13 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
               // not in question because there is nothing to replay. Every tool
               // may pace on it, including one that never declared transient
               // 5xx retries safe — otherwise a protective limit on the relay
-              // turns straight into customer row failures.
+              // turns straight into customer row failures. A scheduler refusal
+              // proves only that this delivery went nowhere: an earlier delivery
+              // of the same attempt may have a row, so the attempt must not move.
               const shedKnownNotDispatched =
                 failure.reason === 'concurrency_backpressure' ||
-                failure.reason === 'provider_pacing_wait';
+                failure.reason === 'provider_pacing_wait' ||
+                failure.reason === 'runtime_scheduler_capacity';
               if (
                 failure.shouldRetry &&
                 (failure.knownNotDispatched ||
@@ -20703,8 +21335,8 @@ export class PlayContextImpl implements ScalarPlayAuthoringRuntimeContext {
                   failure.backpressureDelayMs !== null)
               ) {
                 // A gateway follower is retrying its owner's durable
-                // invocation, while a concurrency or provider-pacing refusal
-                // wrote no invocation at all. Both reuse this logical attempt: advancing it
+                // invocation, while a concurrency, provider-pacing or scheduler
+                // refusal wrote no invocation itself. All reuse this logical attempt: advancing it
                 // either bypasses the live-owner replay fence or makes the
                 // prior-attempt sweep see an intentionally absent receipt.
                 if (